iOS 26 Passkeys: Passkey Enhancements Analysis (WWDC25)

The release of iOS 26 moves Apple's passkey strategy from foundational to mature, delivering enhancements to address developer friction and user lock-in. The key improvements focus on credential portability, frictionless onboarding and complete lifecycle management.

Table 1: Summary of Key Passkey Enhancements in iOS 26

iOS 26 introduces secure credential portability, allowing users to move passkeys between iCloud Keychain and third-party managers like 1Password. Built on the FIDO Alliance's Credential Exchange Protocol (CXP), the transfer is user-initiated, requires biometrics and occurs directly app-to-app, avoiding insecure intermediate files.

For developers of credential managers, Apple introduced ASCredentialExportManager and ASCredentialImportManager. This portability required a deliberate trade-off: deprecating device-specific attestation for exportable credentials. For passkeys synced via iCloud Keychain, Apple's implementation sends a zeroed-out AAGUID, a strategic choice that prioritizes ecosystem openness and user privacy over hardware verification for most consumer use cases.

Passkey Creation in iOS 26

The new Passkey Account Creation API enables a passwordless-by-default onboarding experience. Developers can invoke a native system UI that handles account creation and passkey provisioning in a single, frictionless step.

For more details about the implementation and impact, please refer to our dedicated blog post about the Passkey Account Creation API.

Passkey Overlay in iOS 26 Apps

Passkey Login in iOS 26

iOS 26 introduces critical enhancements for managing passkeys throughout their lifecycle.

• Passkey Management Endpoints: By hosting a simple JSON file at /.well-known/passkey-endpoints, services can declare their passkey enrollment and management URLs, allowing credential managers to link users directly to the correct pages.
• WebAuthn Signal API: Support for the W3C's WebAuthn Signal API allows a service to proactively "signal" changes to the user's device (e.g., username changes), ensuring the passkey stored locally remains accurate. This is available to native apps via the ASCredentialUpdater class and to websites via a corresponding JavaScript API in the browser.

iOS 26 Passkey Settings

The passkey enhancements in iOS 26 represent a comprehensive approach to advancing digital security and user convenience. These enhancements focus on four key areas: secure credential portability, seamless account creation, effective passkey lifecycle management, and synchronization of passkey metadata. Together, these improvements aim to reduce friction, enhance user privacy, and promote widespread adoption of passkeys as a secure alternative to traditional authentication methods. By addressing both user and developer needs, iOS 26 sets a new standard for digital identity management.